Fix GitHub Actions build (#427)

* Fix server build

* Remove server drop-base submod

* Update lockfile

* Use debian images for build

* Fix pino errors, lint

* Fix macOS keychain lookup

Dockerfile

@@ -1,6 +1,8 @@
 # syntax=docker/dockerfile:1
 
-FROM node:lts-alpine AS base
+# Pinned to bookworm so the glibc here matches the torrential build stage
+# and the libarchive runtime package is named `libarchive13` (trixie renames it to libarchive13t64).
+FROM node:lts-bookworm-slim AS base
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
@@ -20,11 +22,17 @@ FROM base AS deps
 RUN pnpm install --frozen-lockfile --ignore-scripts
 
 ### BUILD TORRENTIAL
-FROM rustlang/rust:nightly-alpine AS torrential-build
-RUN apk add musl-dev pkgconfig libarchive-dev libarchive
+# Bookworm-pinned to match the runtime image's glibc (a trixie build would not run on bookworm).
+FROM rustlang/rust:nightly-bookworm-slim AS torrential-build
+## libarchive-dev + pkg-config let libarchive3-sys link libarchive dynamically (glibc).
+## protobuf-compiler is kept for parity (torrential's build.rs uses a vendored protoc).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libarchive-dev \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /build
 COPY . .
-RUN apk add protoc
 RUN cargo build --release --manifest-path ./torrential/Cargo.toml
 
 ### BUILD APP
@@ -34,7 +42,8 @@ ENV NODE_ENV=production
 ENV NUXT_TELEMETRY_DISABLED=1
 
 ## add git so drop can determine its git ref at build
-RUN apk add --no-cache git
+RUN apt-get update && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/*
 
 ## copy deps and rest of project files
 COPY . .
@@ -55,7 +64,19 @@ ENV NODE_ENV=production
 ENV NUXT_TELEMETRY_DISABLED=1
 
 # RUN --mount=type=cache,target=/root/.yarn YARN_CACHE_FOLDER=/root/.yarn yarn add --network-timeout 1000000 --no-lockfile --ignore-scripts prisma@6.11.1
-RUN apk add --no-cache pnpm 7zip nginx
+## runtime deps:
+##  - libarchive13: torrential now links libarchive dynamically (glibc build)
+##  - p7zip-full: provides the 7z CLI
+##  - nginx: front-end proxy
+##  - openssl + ca-certificates: required by Prisma's query engine on Debian
+## pnpm itself is provided by corepack (enabled in the base stage)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libarchive13 \
+    p7zip-full \
+    nginx \
+    openssl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 RUN pnpm install prisma@7.3.0 --global
 # init prisma to download all required files
 RUN pnpm prisma init